CVE-2026-13737

Command Restriction Bypass

State: Published
Severity: 9.2 Critical
Published: Aug 11, 2026
Updated: Aug 11, 2026
Reserved: Jun 29, 2026

Description

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	Commvault

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
Commvault CloudCommvault	11.46.0 through 11.46.9Affectedfrom 11.46.10Not affected 11.44.0 through 11.44.10Affectedfrom 11.44.11Not affected 11.40.0 through 11.40.62Affectedfrom 11.40.63Not affected 11.36.0 through 11.36.113Affectedfrom 11.36.114Not affected

References

https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.